HashiCorp go-slug Zip-Slip Vulnerability Allowing Arbitrary File Write

A zip-slip style vulnerability has been identified in HashiCorp's go-slug library, versions prior to 0.16.2. The issue arises when a user-provided path, which does not exist, is extracted from a tar entry. This flaw allows for improper path validation during the extraction process, potentially leading to path traversal attacks where an attacker could write arbitrary files.

Impact

Exploitation of this vulnerability could result in a zip-slip style path traversal, allowing for arbitrary file writes during the extraction of tar entries.

Remediation

Users of the go-slug library should upgrade to version 0.16.3 or later. The latest releases can be found on the HashiCorp go-slug GitHub Releases page.